RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
检索增强生成（RAG）将外部语料库作为推理证据，攻击者可通过注入恶意文档来引导模型输出其预设的答案。现有的知识投毒检测方法依赖可信参考、特定的攻击特征或对语料库拓扑敏感的全局阈值，难以适应动态变化的检索环境。本文提出 RAGSieve，一个
2026-08-14 归档
今日共收录 1589 条安全情报，包含 784 个 CVE，406 篇安全通告，以及 115 篇研究论文。
← 返回归档列表Discovering Persistent Behavioural Patterns for Interpretable Blockchain Forensics
该论文提出了一种可扩展、与应用场景无关的区块链行为模式发现框架，用于从大规模链上数据中挖掘持久性行为模式，从而支撑可解释的区块链取证分析。研究背景是：公开的区块链数据虽然支持大规模 DeFi 相关分析，但现有方法往往针对特定应用、难以扩展或
VICBench: A Multi-Language Benchmark for Code Vulnerability Detection
本文提出了 VICBench，一个多语言代码漏洞检测基准数据集，专门用于评估漏洞检测工具在识别“漏洞引入提交”（Vulnerability-Inducing Commits, VICs）方面的能力。VICs 是首次将漏洞引入代码库的提交，对
Instruction Alignment for Binary Code Representation Learning
本文研究二进制代码表示学习问题。现有方法主要学习函数级嵌入，捕获二进制函数之间的粗粒度语义关系，但忽略了细粒度的指令级对应关系。作者提出利用编译器调试信息中的指令对齐知识来改进二进制代码表示学习。初步研究发现，针对函数级二进制代码相似性任务
Defending against Model Extraction for GNNs with Model Reprogramming
本文针对图神经网络（GNN）在机器学习即服务（MLaaS）场景下面临的模型提取（Model Extraction, ME）攻击提出了一种主动防御框架 GraphRP。现有防御方法存在“欧几里得偏见”，即直接套用图像领域基于随机噪声等扰动策略
Battlefield 5G: Dual-PKI and TPM-Based UE Attestation for Tactical 5G Standalone Networks
该论文针对战术5G独立组网（Standalone）环境下标准5G-AKA认证机制的不足，提出了一种名为“Battlefield 5G”的预认证框架。标准5G-AKA仅验证USIM中的订阅者凭据，不验证持有该凭据的物理设备身份及其启动状态，这
Dual-Adversarial Safety Alignment: Cultivating Intrinsic Threat Comprehension in LRMs
本论文针对大型推理模型（LRMs）在复杂任务上表现优异但易受有害提示诱导而输出不安全内容的问题，提出了一种名为 AdvSafe 的双对抗安全对齐框架。现有对齐方法通常依赖直接拒绝或安全推理，但往往局限于提示模式而非内在攻击机制，导致难以泛化
A Content-Aware Pure Permutation with Intrinsic Avalanche Effect: Breaking the Diffusion-Permutation Dichotomy
本文针对传统图像加密与数据隐藏中一个长期存在的假设提出挑战：纯像素置换（permutation）本身无法产生差分敏感性（differential sensitivity），即改变一个像素只会使其在输出中重新定位，不会引发雪崩效应。作者认为这
Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
CVE-2026-71362
Attempts to exploit a critical vulnerability (CVE-2026-71362) in Adobe's Commerce and Magento e-commerce platforms have
Critical VMware vCenter RCE flaw exploited for reverse SSH access
CVE-2026-59310
A recently patched critical vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being exploited in an acti
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restric...
CVE-2026-73669
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfa
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-contr...
CVE-2026-73564
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Collaboration (ZCS) ...
CVE-2026-73575
In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange W
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
CVE-2026-73353
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
CVE-2026-66461
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
CVE-2026-66431
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
CVE-2026-61978
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
CVE-2026-28187
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 vers
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the ...
CVE-2026-16241
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service again
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despi...
CVE-2026-14681
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_